CVE-2026-92055 Mozilla CVE debrief

Who should care

Defenders responsible for Firefox and Thunderbird deployments should assess exposure and prioritize verification of versions in their environment. This includes IT security teams, system administrators, and cybersecurity professionals managing these products.

Why it matters

CVE-2026-92055 is a privilege escalation vulnerability in the DevTools component of Firefox and Thunderbird. Defenders should verify exposure, especially for versions prior to the patched releases, and assess the need for compensating controls. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity.

• Verification of affected versions is required to determine exposure.
• Potential privilege escalation could lead to increased risk if not addressed.
• Applying patches or updates may require testing and validation to ensure compatibility.

Technical summary

The vulnerability, CVE-2026-92055, is a privilege escalation issue in the DevTools component of Firefox and Thunderbird products. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The CVSS score is 8.8 with a severity of HIGH. Defenders should prioritize verifying exposure in their Firefox and Thunderbird deployments, especially for versions prior to the patched releases, and assess the need for compensating controls. Verification of affected versions is required to determine exposure.

Defensive priority

Defenders should prioritize verifying exposure in their Firefox and Thunderbird deployments, especially for versions prior to the patched releases, and assess the need for compensating controls.

Recommended defensive actions

• Verify Firefox and Thunderbird versions in your environment against the patched versions.
• Assess exposure based on CPE criteria provided.
• Consider implementing compensating controls for affected versions.
• Review and apply vendor advisories for secure configuration.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and severity of HIGH. Vendor advisories are available for affected products. The CVE record was published on 2026-09-15T13:16:59.370Z and has not been modified since then. The NVD entry is currently Analyzed. Defenders should verify exposure in their Firefox and Thunderbird deployments, especially for versions prior to the patched releases.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.